fix(release): sync the module workspace lockfile on a version bump - #7

The description accurately matches the diff: it adds --locked to the CI module build, updates the module workspace lockfile during the release version-bump step, asserts consistency via cargo metadata --locked, and commits both lockfiles. No workflow permissions are widened, no third-party actions are introduced, and no untrusted context is interpolated into shell. The change looks sound. The code index for this repository is cold, so this review saw the diff alone.

No findings.